kobako 0.23.0 → 0.26.0

data/crates/kobako-transport/src/envelope/reply.rs

@@ -107,6 +107,7 @@ impl YieldReply {
 mod tests {
     use super::*;
 
+    // @behavior WE-018
     #[test]
     fn both_reply_arms_round_trip() {
         for reply in [
@@ -125,6 +126,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-019
     #[test]
     fn an_empty_ok_body_round_trips() {
         let encoded = Reply::Ok(Vec::new()).encode();
@@ -135,6 +137,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-020
     #[test]
     fn an_unknown_reply_tag_is_refused() {
         assert!(
@@ -143,6 +146,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-021
     #[test]
     fn a_zero_length_reply_is_refused() {
         assert!(
@@ -151,6 +155,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-022
     #[test]
     fn every_live_yield_arm_round_trips() {
         let arms = [
@@ -172,6 +177,7 @@ mod tests {
         }
     }
 
+    // @behavior WE-023
     #[test]
     fn the_reserved_yield_tag_is_refused() {
         assert!(
@@ -180,6 +186,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-024
     #[test]
     fn an_unknown_yield_tag_is_refused() {
         assert!(
@@ -188,6 +195,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-025
     #[test]
     fn golden_layout_pins_the_reply_tags() {
         // The same body on both arms: what separates "the Service returned
@@ -206,6 +214,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-026
     #[test]
     fn golden_layout_pins_the_yield_tags() {
         assert_eq!(

data/crates/kobako-transport/src/envelope/run.rs

@@ -39,6 +39,7 @@ impl Run {
 mod tests {
     use super::*;
 
+    // @behavior WE-044
     #[test]
     fn a_run_round_trips() {
         let run = Run {
@@ -53,6 +54,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-045
     #[test]
     fn a_run_with_no_arguments_round_trips() {
         let run = Run {
@@ -67,6 +69,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-046
     #[test]
     fn golden_layout_pins_the_run_field_order() {
         let run = Run {

data/crates/kobako-wasmtime/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.16.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.15.0...kobako-wasmtime-v0.16.0) (2026-09-15)
+
+
+### Miscellaneous Chores
+
+* **kobako-wasmtime:** Synchronize kobako crates versions
+
+## [0.15.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.14.0...kobako-wasmtime-v0.15.0) (2026-09-13)
+
+
+### Features
+
+* **spec:** bring the Rust frontend under the behaviors it answers ([b62243f](https://github.com/elct9620/kobako/commit/b62243f68b338fd219136d60c9cf760d0be03fc0))
+* **spec:** declare the bytes both sides must already agree on ([3875755](https://github.com/elct9620/kobako/commit/3875755999550511837808dcd24a25086bedc926))
+* **spec:** declare what the driver holds a run to ([4539cc1](https://github.com/elct9620/kobako/commit/4539cc16a7ddb6c1706c36282e64182bb480b684))
+
 ## [0.14.0](https://github.com/elct9620/kobako/compare/kobako-wasmtime-v0.13.1...kobako-wasmtime-v0.14.0) (2026-08-06)
 
 

data/crates/kobako-wasmtime/Cargo.toml

@@ -15,7 +15,7 @@
 
 [package]
 name = "kobako-wasmtime"
-version = "0.14.0"
+version = "0.16.0"
 edition = "2021"
 description = "wasmtime implementation of the kobako host runtime contract."
 license = "Apache-2.0"
@@ -28,17 +28,17 @@ categories = ["wasm", "virtualization"]
 # The engine-neutral contract this crate implements. The version pin
 # rides the linked release group; the path keeps in-tree builds (and
 # the Ruby gem, which ships both crates) resolving locally.
-kobako-runtime = { version = "0.14.0", path = "../kobako-runtime" }
+kobako-runtime = { version = "0.16.0", path = "../kobako-runtime" }
 # The fixed tier: the core envelope this driver shuttles and the ABI
 # values it drives the exports against.
-kobako-transport = { version = "0.14.0", path = "../kobako-transport" }
+kobako-transport = { version = "0.16.0", path = "../kobako-transport" }
 # wasmtime — host-side embedder for kobako.wasm. We disable default-features
 # and opt back in only what kobako needs: a Cranelift-backed runtime that can
 # compile a pre-built wasm32-wasip1 module on the host triple, plus the `wat`
 # feature so test fixtures can be expressed as text.
 # `cache` / `parallel-compilation` / `pooling` / `component-model` / `async`
 # are intentionally off — kobako runs short-lived synchronous sandboxes.
-wasmtime = { version = "47.0.2", default-features = false, features = [
+wasmtime = { version = "48.0.1", default-features = false, features = [
     "cranelift",
     "runtime",
     "gc",
@@ -52,7 +52,7 @@ wasmtime = { version = "47.0.2", default-features = false, features = [
 # WasiCtxBuilder + preview1 adapter which wires fd 1/2 to pipes. We omit
 # `p2` (component-model) and `p0`/`p3` (async) because kobako runs
 # synchronous sandboxes only.
-wasmtime-wasi = { version = "47.0.2", default-features = false, features = ["p1"] }
+wasmtime-wasi = { version = "48.0.1", default-features = false, features = ["p1"] }
 # sha2 keys the on-disk compiled-module cache by Guest Binary content
 # (see cache.rs); a collision would load the wrong artifact, so the
 # hash must be cryptographic.

data/crates/kobako-wasmtime/README.md

@@ -24,7 +24,7 @@ SDK consumes the same surface.
 
 ```toml
 [dependencies]
-kobako-wasmtime = "0.14.0" # x-release-please-version
+kobako-wasmtime = "0.16.0" # x-release-please-version
 ```
 
 ## License

data/crates/kobako-wasmtime/src/ambient.rs

@@ -61,6 +61,7 @@ mod tests {
     //! default would re-expose ambient time to a future libc-backed gem.
     use super::*;
 
+    // @behavior RT-047
     #[test]
     fn the_guest_wall_clock_reads_the_unix_epoch() {
         assert_eq!(
@@ -70,6 +71,7 @@ mod tests {
         );
     }
 
+    // @behavior RT-051
     #[test]
     fn the_guest_monotonic_clock_never_advances() {
         assert_eq!(

data/crates/kobako-wasmtime/src/capture.rs

@@ -39,22 +39,26 @@ pub(crate) fn clip_capture(mut raw: Vec<u8>, cap: Option<usize>) -> (Vec<u8>, bo
 mod tests {
     use super::{clip_capture, pipe_capacity};
 
+    // @behavior S-108
     #[test]
     fn pipe_capacity_adds_one_when_cap_is_set() {
         assert_eq!(pipe_capacity(Some(5)), 6);
         assert_eq!(pipe_capacity(Some(0)), 1);
     }
 
+    // @behavior S-109
     #[test]
     fn pipe_capacity_falls_back_to_usize_max_when_uncapped() {
         assert_eq!(pipe_capacity(None), usize::MAX);
     }
 
+    // @behavior S-110
     #[test]
     fn pipe_capacity_saturates_at_usize_max() {
         assert_eq!(pipe_capacity(Some(usize::MAX)), usize::MAX);
     }
 
+    // @behavior S-111
     #[test]
     fn clip_capture_returns_full_bytes_when_under_cap() {
         let (bytes, truncated) = clip_capture(b"abc".to_vec(), Some(5));
@@ -62,6 +66,7 @@ mod tests {
         assert!(!truncated);
     }
 
+    // @behavior S-112
     #[test]
     fn clip_capture_does_not_flag_truncation_at_exactly_cap_bytes() {
         let (bytes, truncated) = clip_capture(b"abcde".to_vec(), Some(5));
@@ -69,6 +74,7 @@ mod tests {
         assert!(!truncated);
     }
 
+    // @behavior S-024
     #[test]
     fn clip_capture_clips_to_cap_and_flags_truncation_on_overflow() {
         // The pipe is sized `cap + 1`, so the snapshot can be at most
@@ -79,6 +85,7 @@ mod tests {
         assert!(truncated);
     }
 
+    // @behavior S-033
     #[test]
     fn clip_capture_treats_none_as_uncapped() {
         let (bytes, truncated) = clip_capture(b"abcdef".to_vec(), None);
@@ -86,6 +93,7 @@ mod tests {
         assert!(!truncated);
     }
 
+    // @behavior S-100 S-101
     #[test]
     fn clip_capture_handles_empty_input() {
         let (bytes, truncated) = clip_capture(Vec::new(), Some(5));

data/crates/kobako-wasmtime/src/frames.rs

@@ -181,7 +181,7 @@ where
 
 #[cfg(test)]
 mod tests {
-    //! Witness the B-54 rung split at the WASI boundary: one probe
+    //! Witness the profile rung split at the WASI boundary: one probe
     //! module reads `wasi:clocks` / `wasi:random` through the context
     //! `install_wasi_frames` builds — frozen under `Hermetic`, live
     //! under `Permissive`.
@@ -243,6 +243,7 @@ mod tests {
         (clock, random)
     }
 
+    // @behavior RT-047 RT-048
     #[test]
     fn hermetic_denies_ambient_time_and_entropy() {
         let (clock, random) = probe_ambient(Profile::Hermetic);
@@ -256,6 +257,7 @@ mod tests {
         );
     }
 
+    // @behavior RT-049 RT-050
     #[test]
     fn permissive_grants_live_ambient_time_and_entropy() {
         let (clock, random) = probe_ambient(Profile::Permissive);

data/crates/kobako-wasmtime/src/guest_mem.rs

@@ -198,6 +198,7 @@ mod tests {
         checked_payload_len, guest_buffer_range, unpack_outcome_packed, MAX_DISPATCH_PAYLOAD,
     };
 
+    // @behavior WE-059
     #[test]
     fn checked_payload_len_accepts_zero_and_the_cap() {
         assert_eq!(checked_payload_len(0), Ok(0));
@@ -207,34 +208,40 @@ mod tests {
         );
     }
 
+    // @behavior WE-060
     #[test]
     fn checked_payload_len_rejects_past_the_cap() {
         assert!(checked_payload_len(MAX_DISPATCH_PAYLOAD + 1).is_err());
         assert!(checked_payload_len(usize::MAX).is_err());
     }
 
+    // @behavior WE-061
     #[test]
     fn guest_buffer_range_returns_half_open_range() {
         assert_eq!(guest_buffer_range(10, 5, 100), Ok(10..15));
     }
 
+    // @behavior WE-062
     #[test]
     fn guest_buffer_range_accepts_zero_length_at_any_in_bounds_ptr() {
         assert_eq!(guest_buffer_range(0, 0, 0), Ok(0..0));
         assert_eq!(guest_buffer_range(42, 0, 100), Ok(42..42));
     }
 
+    // @behavior WE-063
     #[test]
     fn guest_buffer_range_rejects_ptr_plus_len_overflow() {
         assert!(guest_buffer_range(usize::MAX, 1, usize::MAX).is_err());
     }
 
+    // @behavior WE-064
     #[test]
     fn guest_buffer_range_rejects_end_past_memory() {
         assert!(guest_buffer_range(10, 100, 50).is_err());
         assert_eq!(guest_buffer_range(0, 50, 50), Ok(0..50));
     }
 
+    // @behavior WE-001
     #[test]
     fn unpack_outcome_packed_extracts_high_ptr_low_len() {
         assert_eq!(
@@ -243,6 +250,7 @@ mod tests {
         );
     }
 
+    // @behavior WE-065
     #[test]
     fn unpack_outcome_packed_zero_decodes_to_zero_pair() {
         assert_eq!(unpack_outcome_packed(0), (0, 0));

data/crates/kobako-wasmtime/src/invocation.rs

@@ -394,6 +394,7 @@ mod tests {
         );
     }
 
+    // @behavior S-113
     #[test]
     fn dormant_limiter_allows_any_growth() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -402,6 +403,7 @@ mod tests {
         assert_growing(&mut limiter, 100 << 20);
     }
 
+    // @behavior S-114
     #[test]
     fn delta_below_cap_passes_after_activate() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -410,6 +412,7 @@ mod tests {
         assert_growing(&mut limiter, (2 << 20) + (1 << 19));
     }
 
+    // @behavior S-121
     #[test]
     fn delta_past_cap_traps_with_memory_limit_trap() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -418,6 +421,7 @@ mod tests {
         assert_trapping(&mut limiter, 4 << 20);
     }
 
+    // @behavior S-008
     #[test]
     fn activate_resets_baseline_on_each_invocation() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -431,6 +435,7 @@ mod tests {
         assert_growing(&mut limiter, (3 << 20) + (1 << 20));
     }
 
+    // @behavior S-009
     #[test]
     fn disabled_cap_ignores_delta_size() {
         let mut limiter = MemoryLimiter::new(None);
@@ -438,12 +443,14 @@ mod tests {
         assert_growing(&mut limiter, 100 << 20);
     }
 
+    // @behavior S-116
     #[test]
     fn peak_starts_at_zero_before_any_grow() {
         let limiter = MemoryLimiter::new(Some(1 << 20));
         assert_eq!(limiter.peak(), 0);
     }
 
+    // @behavior S-115
     #[test]
     fn peak_tracks_high_water_of_delta_past_baseline() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -454,6 +461,7 @@ mod tests {
         assert_eq!(limiter.peak(), 1 << 19);
     }
 
+    // @behavior S-062
     #[test]
     fn trap_does_not_update_peak() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -464,6 +472,7 @@ mod tests {
         assert_eq!(limiter.peak(), 1 << 19);
     }
 
+    // @behavior S-117
     #[test]
     fn activate_resets_peak_for_new_invocation() {
         let mut limiter = MemoryLimiter::new(Some(1 << 20));
@@ -474,6 +483,7 @@ mod tests {
         assert_eq!(limiter.peak(), 0);
     }
 
+    // @behavior S-118
     #[test]
     fn disabled_cap_still_tracks_peak() {
         let mut limiter = MemoryLimiter::new(None);

data/crates/kobako-wasmtime/src/trap.rs

@@ -110,6 +110,7 @@ mod tests {
     // `increment_epoch` stands in for the ticker to make the ticked
     // state deterministic; under debug overflow checks an overflowing
     // delta panics right here.
+    // @behavior S-119
     #[test]
     fn no_timeout_delta_survives_a_ticked_engine_epoch() {
         let engine = crate::cache::shared_engine().expect("shared engine must be constructible");
@@ -118,6 +119,7 @@ mod tests {
         store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
     }
 
+    // @behavior OC-032
     #[test]
     fn trap_from_routes_timeout_trap_to_timeout() {
         let err = wasmtime::Error::new(TimeoutTrap);
@@ -125,6 +127,7 @@ mod tests {
         assert!(matches!(trap_from(err), Trap::Timeout(msg) if msg == expected));
     }
 
+    // @behavior OC-033
     #[test]
     fn trap_from_routes_memory_limit_trap_to_memory_limit() {
         let trap = MemoryLimitTrap::new(1 << 20, 1 << 19);
@@ -133,6 +136,7 @@ mod tests {
         assert!(matches!(trap_from(err), Trap::MemoryLimit(msg) if msg == expected));
     }
 
+    // @behavior OC-028
     #[test]
     fn trap_from_falls_back_to_other_for_unknown_errors() {
         let err = wasmtime::Error::msg("some other wasmtime fault");
@@ -142,6 +146,7 @@ mod tests {
     // A guest hard trap reaches the host as a wasmtime error whose Display is
     // only the backtrace framing, with the trap reason buried as the chain's
     // root cause. The named-capture regex bug surfaced as exactly this shape.
+    // @behavior OC-029
     #[test]
     fn other_trap_message_surfaces_buried_trap_reason() {
         let err = wasmtime::Error::msg("wasm trap: indirect call type mismatch")
@@ -159,6 +164,7 @@ mod tests {
 
     // A flat error (no cause chain) is its own root_cause; appending it would
     // duplicate the whole message.
+    // @behavior OC-030
     #[test]
     fn other_trap_message_does_not_duplicate_a_flat_error() {
         let err = wasmtime::Error::msg("plain fault");

data/ext/kobako/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kobako"
-version = "0.23.0"
+version = "0.26.0"
 edition = "2021"
 authors = ["Aotokitsuruya <contact@aotoki.me>"]
 license = "Apache-2.0"

data/lib/kobako/capture.rb

@@ -1,26 +1,15 @@
 # frozen_string_literal: true
 
 module Kobako
-  # Host-side captured prefix of guest stdout / stderr produced during a
-  # single +Kobako::Sandbox+ invocation, paired with the truncation flag
-  # the WASI pipe sets when the guest wrote past the configured per-channel
-  # cap.
-  #
-  # Immutable value object: the captured bytes and the truncation flag
-  # always travel together and the instance is frozen on construction.
-  # Construct via +Capture.new(bytes:, truncated:)+ for the ext-provided
-  # binary bytes (the constructor handles the UTF-8 / ASCII-8BIT fallback)
-  # or reach +Capture::EMPTY+ for the pre-invocation sentinel that
-  # +Sandbox+ uses before any invocation has executed.
+  # What one invocation wrote to stdout or stderr, up to that channel's
+  # cap, together with whether it wrote past the cap. Frozen, so the bytes
+  # and the flag always travel together.
   class Capture
     attr_reader :bytes
 
-    # Build a Capture wrapping +bytes+ (the captured prefix as a String) and
-    # +truncated+ (whether the originating WASI pipe reported the cap was
-    # hit). Coerces +bytes+ to UTF-8 when they are valid UTF-8, otherwise
-    # falls back to ASCII-8BIT so invalid sequences remain inspectable
-    # without raising; +bytes+ is duplicated, never mutated. Freezes the
-    # instance so callers cannot mutate the pair.
+    # The bytes read as UTF-8 when they are valid UTF-8, and as binary
+    # otherwise, so output that is not text stays inspectable instead of
+    # raising. The caller's String is copied, never changed.
     def initialize(bytes:, truncated:)
       copy = bytes.dup.force_encoding(Encoding::UTF_8)
       copy.force_encoding(Encoding::ASCII_8BIT) unless copy.valid_encoding?
@@ -29,13 +18,10 @@ module Kobako
       freeze
     end
 
-    # Returns +true+ iff the underlying capture channel exceeded its
-    # configured cap during the originating +Sandbox+ invocation.
+    # Whether the invocation wrote past this channel's cap.
     def truncated? = @truncated
 
-    # Pre-invocation sentinel. Empty UTF-8 bytes and +truncated? == false+;
-    # reused by every fresh +Sandbox+ and by +Sandbox+ between invocations
-    # to denote "no capture yet".
+    # The capture before any invocation has written anything.
     EMPTY = new(bytes: "", truncated: false)
   end
 end

data/lib/kobako/catalog/handles.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
+require "delegate"
+
 require_relative "../handle"
+require_relative "../transport/exposure"
 
 module Kobako
   module Catalog
@@ -29,7 +32,9 @@ module Kobako
       # tests pass a value near +Kobako::Handle::MAX_ID+ to exercise
       # the cap-exhaustion path without 2³¹ allocations.
       def initialize(next_id: 1)
-        @entries = {} # : Hash[Integer, untyped]
+        @entries = {} # : Hash[Integer, Kobako::Transport::Exposure]
+        surfaces = {} # : Hash[Module, Set[Symbol]]
+        @surfaces = surfaces.compare_by_identity
         @next_id = next_id
       end
 
@@ -45,19 +50,31 @@ module Kobako
       # allocator's output a domain entity. An id is the Handle's only
       # content, so the same internal +Kobako::Handle.restore+ constructor
       # serves both this allocator and the codec's wire-decode path.
+      #
+      # The entry records the object's Exposure as it stands at mint, so a
+      # call made through this Handle is authorized against the reference
+      # the guest was given.
       def alloc(object)
         reject_unwrappable!(object)
         ensure_capacity!
         id = @next_id
-        @entries[id] = object
+        @entries[id] = Kobako::Transport::Exposure.of(object, @surfaces)
         @next_id = id + 1
         Kobako::Handle.restore(id)
       end
 
-      # Resolve a Handle ID to its bound object. +id+ is a Handle ID previously
-      # returned by +#alloc+. Returns the bound object. Raises
-      # +Kobako::SandboxError+ if +id+ is not currently bound.
+      # Resolve a Handle ID to its bound object — the very object +#alloc+
+      # received, so a Handle crossing back restores to it. +id+ is a Handle
+      # ID previously returned by +#alloc+. Raises +Kobako::SandboxError+ if
+      # +id+ is not currently bound.
       def fetch(id)
+        exposure(id).object
+      end
+
+      # The Exposure +id+ was minted with, which authorizes a call the guest
+      # makes through that Handle. Raises +Kobako::SandboxError+ if +id+ is
+      # not currently bound.
+      def exposure(id)
         require_bound!(id)
         @entries[id]
       end
@@ -79,13 +96,20 @@ module Kobako
       # reflection (a returned +Binding+ reaches +Binding#eval+); a +Class+
       # or +Module+ hands over its class-level API (+File.popen+ / +read+,
       # +Kernel.system+), which the owner-based dispatch floor cannot see
-      # because a singleton-class owner matches no core-module list. Raising
-      # here keeps the rule at the single mint point, so it holds on both the
+      # because a singleton-class owner matches no core-module list; a
+      # +Delegator+ (+SimpleDelegator+, +DelegateClass+, +WeakRef+,
+      # +Tempfile+) is a transparent forwarder whose public +method_missing+
+      # binds and calls the private method the guest names (+Kernel#system+),
+      # a surface the floor reads as ordinary Service behaviour. Raising here
+      # keeps the rule at the single mint point, so it holds on both the
       # Service-return and the +#run+ host→guest auto-wrap paths.
       def reject_unwrappable!(object)
         case object
-        when Binding, Method, UnboundMethod, Module
-          raise SandboxError, "a #{object.class} cannot cross as a Capability Handle"
+        when Binding, Method, UnboundMethod, Module, Delegator
+          # Delegator < BasicObject exposes no static +#class+, so name the
+          # rejected object's class through Object's own.
+          kind = Object.instance_method(:class).bind_call(object)
+          raise SandboxError, "a #{kind} cannot cross as a Capability Handle"
         end
       end
 

data/lib/kobako/catalog/services.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
 
 require_relative "../errors"
+require_relative "../transport/exposure"
 
 module Kobako
   module Catalog
     # Kobako::Catalog::Services — per-Sandbox registry of Service
     # bindings keyed by their constant-path name. Holds the flat
-    # path→object table and the declared path set every invocation
+    # path→Exposure table and the declared path set every invocation
     # announces on Frame 1.
     #
     # Public API:
@@ -14,7 +15,7 @@ module Kobako
     #   services = Kobako::Catalog::Services.new
     #   services.bind("MyService::KV", kv_object)  # => services (chainable)
     #   services.paths                             # => ["MyService::KV"]
-    #   services.lookup("MyService::KV")           # => kv_object
+    #   services.lookup("MyService::KV").object    # => kv_object
     #
     # Per-dispatch routing is +Kobako::Transport::Dispatcher+'s
     # responsibility — the Dispatcher resolves a path against the invocation's
@@ -29,7 +30,7 @@ module Kobako
 
       # Build a fresh registry.
       def initialize
-        @bindings = {} # : Hash[String, untyped]
+        @bindings = {} # : Hash[String, Kobako::Transport::Exposure]
         @sealed = false
       end
 
@@ -39,14 +40,15 @@ module Kobako
       # chaining. Raises +ArgumentError+ when a segment is malformed, when
       # +path+ collides with an existing binding (a name is a bound Service
       # or a grouping prefix, never both), or when the owning Sandbox has
-      # been sealed by its first invocation.
+      # been sealed by its first invocation. The binding records +object+'s
+      # Exposure as it stands now.
       def bind(path, object)
         raise ArgumentError, "cannot bind after first Sandbox invocation" if @sealed
 
         path_str = validate_path!(path)
         raise ArgumentError, "Service path #{path_str} conflicts with an existing binding" if collision?(path_str)
 
-        @bindings[path_str] = object
+        @bindings[path_str] = Kobako::Transport::Exposure.of(object)
         self
       end
 
@@ -56,8 +58,8 @@ module Kobako
         @bindings.key?(path.to_s)
       end
 
-      # Resolve a +target+ constant path to the bound Service. Raises
-      # +KeyError+ when no Service is bound at +target+.
+      # Resolve a +target+ constant path to the bound Service's Exposure.
+      # Raises +KeyError+ when no Service is bound at +target+.
       def lookup(target)
         target_str = target.to_s
         raise KeyError, "no service bound at #{target_str.inspect}" unless @bindings.key?(target_str)